forked from buildroot/buildroot
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathCHANGES
More file actions
16563 lines (12930 loc) · 649 KB
/
CHANGES
File metadata and controls
16563 lines (12930 loc) · 649 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
2026.02, released March 4th, 2026
Various fixes.
Updated/fixed packages: freerdp, graphicsmagick, ruby, nsquid,
vim
2026.02-rc3, released March 2nd, 2026
Fixes all over the tree.
support/testing/run-tests: Work around a node2 patch in Debian
testing/unstable:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129350
Updated/fixed packages: bind, botan, containerd, cups, gpsd,
flashbench, igmpproxy, imagemagick, libssh, libunistring,
libvirt, mesa3d, mupdf, openscap, patch, poco,
python-multipart, rtl_433, safeclib, samba4, tinyproxy,
udisks, webkitgtk, wireshark, wlroots, wpewebkit
2026.02-rc2, released February 24th, 2026
Fixes all over the tree.
Updated/fixed packages: bind, c-ares, libzlib, mpir, netsnmp,
python-anyio, python-fastapi, python-jsonschema,
python-pybind, python-starlette, qemu, ruby, snort, systemd,
wmctrl, wpewebkit
2026.02-rc1, released February 17th, 2026
Fixes all over the tree and new features.
Arch:
- Add HPPA architecture support
- Drop ARC big-endian support
Toolchain:
- Kernel headers: use 6.19.x by default, removed 6.17.x, added
6.19.x support.
- Binutils: use 2.44 by default, removed 2.42.x, added 2.45.x series.
Misc:
- Various tweaks to utils/generate-cyclonedx for better SBOM
compatibility and more detailed annotations for CVEs fixed
by patches in Buildroot.
New defconfigs: AMD Versal2 VEK385, HP-9000, QEMU HPPA B160L,
STM32h747i-disco
Removed defconfigs: Raspberrypi3 qt5we
New packages: adsp-ldr, aichat, k3conf, kibi, libplacebo,
libxmlsec1, libyang-cpp, nqptp, openscap,
python-annotated-doc, python-base58, python-coherent-licensed,
python-diskcache, python-gpiod,
python-ipython-pygments-lexers, python-librt,
python-markdown-it-py, python-mdit-py-plugins, python-mdurl,
python-memray, python-platformdirs, python-rich,
python-sdbus-systemd, python-textual, python-varlink,
qoriq-restool, rasdaemon, sigsum-go, sysrepo-cpp, yq, zellij
Removed packages: alure, bootstrap, chartjs, connman-gtk,
cppdb, criu, cvs, datatables-buttons, datatables-fixedcolumns,
datatables-responsive, datatables, dbus-triggerd, dmraid,
dvdrw-tools, explorercanvas, flot, forge, gconf, hawktracer,
jquery-datetimepicker, jquery-keyboard, jquery-mobile,
jquery-sidebar, jquery-sparkline, jquery-ui-themes, jquery-ui,
jquery-validation, jquery, jsmin, json-javascript, jszip,
let-me-create, libcgi, libcuefile, libfreeimage, libiqrf,
libmhash, libnids, libsvg-cairo, libsvg, libuwsc, lockdev,
musepack, opencv3, openlayers, openpowerlink, opentracing-cpp,
php-zmq, python-aioredis, qjson, racehound, rpi-userland,
sconeserver, softether, taskd, vis-network, vuejs-router,
vuejs, xdriver_xf86-input-mouse
Issues resolved:
- GNU GRUB (BIOS) with f2fs filesystem failed
https://gitlab.com/buildroot.org/buildroot/-/issues/61
- The shadow package does not correctly configure the ENCRYPT_METHOD..
https://gitlab.com/buildroot.org/buildroot/-/issues/134
- EGL not found when building libWPE from buildroot base folder
https://gitlab.com/buildroot.org/buildroot/-/issues/144
- Awkward error message: "Fix you path"
https://gitlab.com/buildroot.org/buildroot/-/issues/151
- Detected presence of version control tool artifacts
https://gitlab.com/buildroot.org/buildroot/-/issues/154
- run-tests tool broken with Python 3.14
https://gitlab.com/buildroot.org/buildroot/-/issues/156
- Moving away from bminor Github mirrors
https://gitlab.com/buildroot.org/buildroot/-/issues/160
- How can I make the 'en_US' locale by default?
https://gitlab.com/buildroot.org/buildroot/-/issues/161
2025.11.2, released February 20, 2026
avahi: CVE-2021-3468, CVE-2023-38469, CVE-2023-38470, CVE-2023-38471,
CVE-2023-38472, CVE-2023-38473, CVE-2024-52615, CVE-2024-52616,
CVE-2025-68276, CVE-2025-68468, CVE-2025-68471, CVE-2026-24401
bind: CVE-2025-13878
busybox: CVE-2025-46394, CVE-2025-60876
expat: CVE-2026-24515, CVE-2026-25210
glibc: CVE-2025-15281, CVE-2026-0861, CVE-2026-0915
gnutls: CVE-2025-14831, CVE-2026-1584
go: CVE-2025-61732, CVE-2025-68121, CVE-2025-61728, CVE-2025-61726,
CVE-2025-68121, CVE-2025-61731, CVE-2025-61730
gpsd: CVE-2025-67268, CVE-2025-67268
haproxy: CVE-2025-11230
intel-microcode: CVE-2024-24853, CVE-2025-31648
libopenssl: CVE-2025-11187, CVE-2025-15467, CVE-2025-15468,
CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419,
CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796
libpng: CVE-2026-22695, CVE-2026-22801, CVE-2026-25646
libtasn1: CVE-2025-13151
libvpx
linux-pam: CVE-2024-10963
nginx: CVE-2025-53859
nodejs: CVE-2025-27210, CVE-2025-55130, CVE-2025-55131, CVE-2025-55132,
CVE-2025-59465, CVE-2025-59466, CVE-2026-21637
python3: gh-144125, gh-143935, gh-143925, gh-143919, gh-143916
python-django: CVE-2025-13473, CVE-2025-14550, CVE-2026-1207,
CVE-2026-1285, CVE-2026-1287, CVE-2026-1312
python-urllib3: CVE-2026-21441
strongswan: CVE-2025-62291
tor: TROVE-2025-016
vim: CVE-2025-66476
webkitgtk
Infrastructure updates/fixes:
arm-trusted-firmware, at91bootstrap3, barebox, linux, opensbi, optee-os,
uboot: Add support for custom license files
config-fragments/autobuild: drop a number of duplicated toolchains
generate-cyclonedx: fix dependencies
Makefile: add check-package-external target
pkg-stats: add -N/--needs-update option
pkg-stats: fix RuntimeError with python 3.14 asyncio
relocate-sdk.sh: pre-calculate files in need of relocation
system/Config.in: do not reference md5 for sha256 option
testing/run-tests: specify multiprocessing method
testing: fix SdbusModemmanager/SdbusNetworkmanager duplicate test name
testing: python-requests: new runtime test
testing: test_python.py: disable interpreter colors
testing: test_python_sdbus_modemmanager: remove unneeded systemd vconsole
testing/tests/package/test_firewalld: use ext2 instead of cpio
Updated / fixed packages: aardvark-dns, asterisk, at91bootstrap3, avahi,
berkeleydb, bind, bitcoin, blake3, brltty, brotli, busybox cryptsetup,
dash, dc3dd, docker-engine, easy-rsa, efl, ell, expat, frr, glibc,
gnutls, go, gpsd, grub2, haproxy, igmpproxy, intel-microcode,
kvm-unit-tests, libcec, libbsd, libcdio-paranoia, libcurl, libgphoto2,
libgpiod2, libite, libopenssl, libpng, libtasn1, libucl, libvpx,
libwebsockets, linux, linux-headers, linux-pam, localedef, lockdev,
m4, manual, mcelog, mesa3d, mp4v2, mpg123, mpir, mupdf, netdata,
netsniff-ng, nginx, nodejs, parprouted, php, php-lua, pkg-utils, podman,
python3, python-django, python-jinja2, python-urllib3, qemu, rp-pppoe,
rust-bindgen, safeclib, samba4, sane-airscan, screen, shadow, shapelib,
spandsp, squeezelite, strongswan, swig, syslog-ng, systemd, tor, uboot,
uclibc, uftp, util-linux, vim, vsftpd, webkitgtk, wireless-regdb,
xmlstarlet, zeek
Removed packages: criu, cvs, dbus-triggerd, dvdrw-tools, libsvg, libsvg-cairo, lockdev, gconf,
2025.11.1, released January 20, 2026
Important / security related fixes:
apache: CVE-2025-55753, CVE-2025-58098, CVE-2025-59775, CVE-2025-65082,
CVE-2025-66200
cryptsetup
dropbear: CVE-2025-14282, CVE-2019-6111
exim: CVE-2025-67896
gnupg2
imagemagick: CVE-2025-66628
libarchive
libcoap: CVE-2025-59391, CVE-2025-65493, CVE-2025-65494
CVE-2025-65495, CVE-2025-65496, CVE-2025-65497, CVE-2025-65498,
CVE-2025-65499, CVE-2025-65500, CVE-2025-65501
libcurl: CVE-2025-13034, CVE-2025-14017, CVE-2025-14524,
CVE-2025-14819, CVE-2025-15079, CVE-2025-15224
libfcgi: CVE-2025-23016.
libfreeimage: CVE-2019-12211, CVE-2019-12213, CVE-2020-24292,
CVE-2020-24293, CVE-2020-24295, CVE-2021-33367, CVE-2021-40263,
CVE-2021-40266, CVE-2023-47995, CVE-2023-47997
libpng: CVE-2025-66293
liburiparser: CVE-2025-67899
libxslt: CVE-2025-7424, CVE-2025-9714, CVE-2025-11731
linenoise: CVE-2025-9810
perl: CVE-2025-40909
php: CVE-2025-14177, CVE-2025-14178, CVE-2025-14180
python-django: CVE-2025-13372, CVE-2025-64460
python-filelock: CVE-2025-68146
python-fonttools: CVE-2025-66034
python-urllib3: CVE-2025-66471, CVE-2025-66418
unbound: CVE-2025-11411
vlc
xserver_xorg-server: CVE-2025-62229, CVE-2025-62230,
CVE-2025-62231
xwayland: CVE-2025-62229, CVE-2025-62230, CVE-2025-62231
Infrastructure updates/fixes:
- pkg-stats use HEAD request & unique HTTP user-agent
- cve-check: don't fail with unknown CVE
- generate-cyclonedx: support 'resolved_with_pedigree'
- testing: add host bin dir to PATH
- testing: add tests for FIT hash support in package/uboot-tools
- testing: add libiio python bindings runtime test
- testing: ddrescue: use dmsetup from lvm2
- testing: ddrescue: use f-string for test config
- testing: add tio runtime test
- add 'CVE:' trailer in various patches
- add md5 hash and update tarball url to various python packages
- testing: ltp-testsuite: replace runltp by kirk
- testing: new kvmtool runtime test
- gitignore: ignore utils/brmake log output named `br.log`
- testing: add opus-tools runtime test
- testing: add flac runtime test
- testing: test_xen: add block
Updated / fixed packages: apache, arm-trusted-firmware, atf, audit,
bitcoin, boost, busybox, cage, cmake, collectl, cppcms, cpulimit,
cryptsetup, dbus, dmraid, dropbear, efl, embiggen-disk, evilwm, exim,
ficl, fio, fluent-bit, fontconfig, glibc, gnupg2, grpc, gvfs, icu,
imagemagick, irqbalance, iwd, kvmtool, ledmon, libarchive, libcoap,
libconfig, libcpprestsdk, libcurl, libdill, libdnet, libfcgi, libfreeimage,
libgit2, libgtk3, libgtk4, libiio, libmbus, libpng, libselinux, libtirpc,
libupnp, liburiparser, libvncserver, libxslt, linenoise, linux-tools,
lttng-modules, lugaru, matchbox-fakekey, matchbox-keyboard, matchbox-lib,
matchbox-panel, mender-update-modules, mesa3d, mosh, nfs-utils, open-lldp,
opencv4, opencv4-contrib, openjdk, perl, perl-dbd-mysql, perl-mozilla-ca,
php, pigz, pixman, python-brotli, python-can, python-certifi, python-django,
python-filelock, python-fonttools, python-pyqt5, python-urllib3, python3,
qt5enginio, qt5webkit, qt6base, racehound, rdesktop, rpcbind, rpi-firmware,
rtl8192eu, rtl8723bu, rtl8723ds, rtl8821au, rtl8821cu, rtl8822cs, samba4,
skopeo, softether, softhsm2, spice, ssdp-responder, sway, tio, trinity,
tzdata, uboot, uboot-tools, uclibc, unbound, utfcpp, v4l2loopback, vim, vlc,
xdriver_xf86-video-intel, xen, xinetd, xlib_libxshmfence,
xserver_xorg-server, xvkbd, xwayland, zic, zxing-cpp
Removed packages: opencv3 'protobuf', opencv3 'ffmpeg',
libdnet 'python', rpi-firmware 'vcdbg'
2025.11, released December 11th, 2025
Fixes all over the tree.
linux: Default to 6.18 for runtime kernel and kernel headers,
drop the now EOL 5.4.x series.
Updated/fixed packages: apache, audit, cryptodev-linux,
dmraid, ficl, glibc, go, intel-mediadriver, intel-vpl-gpu-rt,
kbd, libcap, libdbi, libgit2, libpng, libtirpc, libxslt,
lugaru, mosh, pigz, podman, python-fonttools, python-urllib3,
python3, racehound, rdesktop, rtl8188eu, softhsm, sqlite,
strace, unbound, unzip, xapp_xkbutils,
xdriver_xf86-video-intel, xl2tp, xserver_xorg-server, xwayland
2025.11-rc2, released November 30th, 2025
Fixes all over the tree.
Infrastructure: support/scripts/check-merged (introduced in
2025.11-rc1) no longer relies on getopt from util-linux
Defconfigs: pine64 star: Update U-Boot and Linux kernel to fix
builds with GCC 14.x
Updated/fixed packages: 18xx-ti-utils, depot-tools, e2fsprogs,
enscript, fio, gnutls, intel-mediadriver, intel-vpl-gpu-rt,
ledmon, libpng, libteam, lmbench, mongoose, netsnmp,
nss-pam-ldapd, open-plc-utils, oprofile, pdmenu, php-apcu,
php-pecl-dbus, php-xdebug, php-yaml, python-flask-restx,
python-pysocks, python-starlette, sane-backends, sbc, sdl,
stress-ng, swipl, syslinux, time, tmux, tor, uboot-tools,
woff2, xfsprogs, yaml-cpp
Removed packages: libargtable2, starfive-spltool
2025.11-rc1, released November 20th, 2025
Fixes all over the tree and new features.
Infrastructure:
- Support merged /usr/sbin/ (E.G. sbin a symlink to bin rather
than separate directories), which is required by systemd
256+
- support/scripts/cve-check can now be used to enrich a SBOM
in CycloneDX format (as generated by
utils/generate-cyclonedx) with vulnerability analysis from
the NVD database.
Dropped a number of old and unmaintained packages and external
toolchains.
New defconfigs: Compulab IOT-GATE-iMX8 EBBR, QEMU x86-64 EFI
Removed defconfigs: at91sam9260eknf, atmel_sama5d3xek,
roseapplepi
New packages: broot, bvi, go-bootstrap-stage4, libpam-pkcs11,
llama-cpp, nnn, python-crccheck, python-fs, python-patch-ng,
python-pyfatfs, python-scp, python-whitenoise, snapboot, wmenu
Removed packages: aufs, aufs-util, axfsutils, bctoolbox,
belle-sip, belr, dmenu-wayland, dvbsnoop,
ev3dev-linux-drivers, expect, fbtft, gtk2-engines, gtkperf,
leafpad, lesstif, libbson, libglade, libgtk2, libjwt, libsexy,
linphone, logsurfer, mediastreamer, metacity, mongrel2, ola,
ortp, procrank_linux, ramspeed, sylpheed
2025.08.3, released December 11, 2025
Important / security related fixes:
- asterisk: CVE-2025-1131, CVE-2025-57767, CVE-2025-49832,
CVE-2025-47780, CVE-2025-47779
- gnutls: CVE-2025-9820
- libpng: CVE-2025-64505, CVE-2025-64506, CVE-2025-64720, CVE-2025-65018
- luksmeta: CVE-2025-11568
- mariadb: CVE-2025-30693, CVE-2025-30722, CVE-2023-52969,
CVE-2023-52970, CVE-2023-52971
- openvpn: CVE-2025-13086
- postgresql: CVE-2025-12817, CVE-2025-12818
- python-django: CVE-2025-64458, CVE-2025-64459
- python-startlette: GHSA-7f5h-v6xp-fcq8
Infrastructure updates/fixes:
- New script support/scripts/cve-check to enricht CycloneDX SBoM with
CVE information from NVD database.
Updated / fixed packages: 18xx-ti-utils, asterisk, enscript, gnutls,
libpng, libroxml, libteam, linux-headers, luksmeta, mariadb, nbd, neard,
nss-pam-ldapd, open-plc-utils, openjdk, openjdk-bin, openvpn, oprofile,
pdmenu, perl-net-ssleay, postgresql, python-django, python-starlette,
redis, sane-bacends, sbc, sdbusplus, sdl, swipl, tailscale, thermald,
tmux, tor
Removed packages: bctoolbox, belle-sip, belr, linphone, mediastreamer,
mongrel2, ortp
2025.08.2, released November 20, 2025
Important / security related fixes:
- bind: CVE-2025-8677, CVE-2025-40778, CVE-2025-40780
- dante: CVE-2024-54662
- erlang: CVE-2024-53846, CVE-2025-4748, CVE-2025-26618, CVE-2025-30211,
CVE-2025-32433, CVE-2025-46712, CVE-2025-48038,
CVE-2025-48039, CVE-2025-48040, CVE-2025-48041
- hostapd: CVE-2025-24912
- imagemagick: CVE-2025-62171
- iptraf-ng: CVE-2024-52949
- libarchive: CVE-2025-25724
- libglib2: CVE-2024-54662
- libvips: CVE-2025-29769, CVE-2025-59933
- libvpx: CVE-2025-5283
- libxslt: CVE-2025-24855, CVE-2024-55549
- mbedtls: CVE-2025-54764, CVE-2025-59438
- modsecurity2: CVE-2025-52891, CVE-2025-54571
- netdata: CVE-2023-22496, CVE-2023-22497
- podman: CVE-2025-9566
- poppler: CVE-2024-6239, CVE-2024-56378, CVE-2025-32364,
CVE-2025-32365, CVE-2025-43903, CVE-2025-50420,
CVE-2025-52886
- python3: gh-139312, gh-139700, gh-139400, gh-135661, gh-135661,
gh-102555, gh-135462, gh-118350, gh-86155
- python-webpy: CVE-2025-3818
- redis: CVE-2025-46817, CVE-2025-46818, CVE-2025-46819, CVE-2025-49844
- samba: CVE-2025-3818, CVE-2025-10230
- shairport-sync: Upstream security fixes without CVE
- squid: CVE-2025-59362
- suricata: CVE-2024-37151, CVE-2024-38535
- tpm2-tss: CVE-2024-29040
- xerces: CVE-2024-23807
- zabbix: CVE-2025-27231, CVE-2025-27236, CVE-2025-27238, CVE-2025-49641
- zip: CVE-2018-13410
Infrastructure updates/fixes:
- Improved matching of CPE ID with NVD database, resulting in more accurate
identification of CVEs.
- brmake: avoid garbled output with top-level parallel build
Updated / fixed packages: 4th, audit, bind, cmake, crun, dante,
ebtables, erlang, freeradius-server, freerdp, gpsd, gstd, hostapd,
imagemagick, iptraf-ng, ledmon, libarchive, libcurl, libdbi-drivers,
libdisplay-info, libglib2, libgphoto2, libgtk3, libheif, libiconv,
libsemanage, libshout, libsolv, libtpms, libvips, libvpx, libwpe,
libxslt, linux, linux-headers, live555, mbedtls, micropython,
mjpg-streamer, modsecurity2, netdata, podman, poppler, python3,
python-flask-cors, python-webpy, quota, qt6multimedia, redis, refpolicy,
samba4, shairport-sync, selinux-python, sexpect, siproxd, sqlite, squid,
suricata, tor, tpm2-tss, waffle, webkitgtk, wireless-regdb, wpewebkit,
xerces, zabbix, zip
Removed package: ramspeed
Boards updated / fixed: andes_ae350_45, beaglebone, beagleboneai,
cubieboard1, cubieboard2, imx6ulz_bsh_smm_m2, imx8mn_bsh_smm_s2,
imx8mn_bsh_smm_s2_pro, olimex_a20_olinuxino_lime*, stm32f429_disco_xip,
stm32f746_disco_sd, stm32f769_disco_sd, stm32mp1*_dk*, ti_am62x_sk
Test Improvements:
- Capture output of failing commands on host.
2025.08.1, released October 11, 2025
Important / security related fixes:
- atop: CVE-2025-31160
- civetweb: CVE-2025-55763
- cjson: CVE-2025-57052
- connman: CVE-2025-32366, CVE-2025-32743
- cups: CVE-2025-58060, CVE-2025-58364
- expat: CVE-2025-59375
- fastd: CVE-2025-24356
- fetchmail: CVE number pending
- ghostscript: CVE-2025-59798, CVE-2025-59799, CVE-2025-59800,
CVE-2025-59801
- intel-microcode: CVE-2025-20053, CVE-2025-20109, CVE-2025-22839,
CVE-2025-22840, CVE-2025-22889, CVE-2025-26403
- jasper: CVE-2023-51257, CVE-2025-8835
- libcurl: CVE-2025-10148, CVE-2025-9086
- libopenssl: CVE-2025-9230, CVE-2025-9231, CVE-2025-9232
- libssh: CVE-2025-8114, CVE-2025-8277
- lua: CVE-2014-5461
- opencv4: CVE-2025-53644
- pcre2: CVE-2025-58050
- poco: CVE-2025-6375
- postgresql: CVE-2025-8713, CVE-2025-8714, CVE-2025-8715
- python-django: CVE-2025-57833, CVE-2025-59681, CVE-2025-59682
- python-pip: CVE-2025-8869
- raptor: CVE-2024-57822, CVE-2024-57823
- syslog-ng: CVE-2024-47619
- tiff: CVE-2024-13978, CVE-2025-8961, CVE-2025-9165
Updated / fixed packages: asterisk, boinc, boot-wrapper-aarch64, c-icap,
chocolate-doom, cjson, cpp-httplib, cutekeyboard, docker-engine, fatcat,
fluent-bit, gnupg2, gnuplot, htpdate, iputils, kodi, libfreeimage,
libopenssl, libselinux, libsemanage, libxkbcommon, libxmlrpc,
linux-firmware, linuxptp, llvm, luaossl, luvi, mariadb, mdio-tools,
modsecurity2, openjpeg, pango, php-lua, policycoreutils,
python-aiohttp-session, python-certifi, python-cryptography,
python-flask-cors, python-pytz, python-trove-classifiers,
python-typing-extensions, rtl8723bu, rtl8723ds, rtl8821cu, rtl8822cs,
rtl_433, ruby, samba4, sysprof, ti-k3-boot-firmware, tiff, tor, uboot,
uclibc, upx, vulkan-headers, webkitgtk, wilc-driver, wlroots, x11r7,
xilinx-embeddedsw, xilinx-prebuilt, xlib_xtrans, xr819-xradio, zziplib
Boards updated / fixed: beagleboneai, loongarch64-efi, qemu (all),
versal, zedboard
Boards removed: at91sam9260eknf, atmel_sama5d3xek, roseapplepi
Test Improvements:
- test_docker_compose: update kernel & VM CPU
- TestZfsUclibc: use internal backend for uClibc-ng toolchain
- GitTestBase: remove git daemon due to Gitlab-CI security settings
2025.08, released September 7th, 2025
Fixes all over the tree.
Infrastructure:
- 'make show-info' now also displays the package directory.
- utils/bump-stable-kernel-versions helper script to bump
Linux (headers) kernel versions.
Fixed defconfigs: QEMU ARM / Aarch64 EBBR / SBSA, Sipeed
licheepi zero, TI am62x sk
Removed defconfigs (build failures): Bananapro, Beelink gs1,
Chromebook snow, Engicam i.MX6 boards, Galileo, Microchip
at91sam9g20df / at91sam9g45m10ek / at91sam9rlek, Odroid XU-4,
Orangepi lite2 / one+, Pcengine apu2, Pine64 rock64 / sopine,
Raxda rockpin8, Riotboard, Socrates cyclone5, Technologic
TS-7680, Toradex Apalis i.MX6
Updated/fixed packages: apitrace, avrdude, b43-firmware, bat,
brcm-patchram-plus, busybox, ecryptfs-utils, exiv2, ffmpeg,
firewalld, gdb, go, imagemagick, input-event-daemon, iozone,
ipmitool, jose, libcap-ng, libfreeglut, libftdi1, libgsm,
libkrb5, libsoxr, lighttpd, lirc-tools, lua-utf8, mariadb,
mbpfan, micropython, mosquitto, netavark, openal, postgis,
python-flask-cors, python-h2, python-yarl, python3, rtl8188eu,
rtl8821au, sqlite, squid, sslh, tcpreplay, timescaledb,
tstools, uclibc, udisks, unbound, vde2,
webrtc-audio-processing, wipe, wireshark, xlib_libXt
Removed packages: libsvgtiny, netstat-nat,
netsurf-buildsystem, thttpd
2025.08-rc3, released August 28th, 2025
Fixes all over the tree, mainly GCC 15.x build fixes
support/misc/pkg-stats: Be more robust when parsing CVEs
Fixed defconfigs: canaan_kd233, sipeed_maix*: Correct Linux
image name configuration, ci20: Needs host-openssl,
imx6ulz_bsh_smm_m2: Use correct FPU configuration
Removed defconfigs: kontron_pitx_imx8m
Updated/fixed packages: binutils, cpp-httplib, dtach,
dump1090, ffmpeg, gdbm, gpm, libjwt, liblog4c-localtime,
libv4l, lrzsz, mesa3d, p11-kit, php-lua, proftpd,
python-aexpect, python-pyroute2, python3, rpi-userland, sdl,
vim, wayland, weston, wpewebkit, xvisor
Removed packages: liboauth
2025.08-rc2, released August 21th, 2025
Fixes all over the tree.
The release tarballs are now built reproducibly.
Updated/fixed packages: bash, bcusdk, ed, elfutils, gcc,
gcc-bare-metal, go, grub, gst1-devtools, gst1-libav,
gst1-plugins-bad, gst1-plugins-base, gst1-plugins-good,
gst1-plugins-ugly, gst1-python, gst1-rtsp-server, gst1-vaapi,
gstreamer1, gstreamer1-editing-services, hwdata, iperf3, jq,
libcue, libtracefs, modem-manager, ofono, openconnect,
openjpeg, openocd, prboom, python-numpy, rpcbind, rrdtool,
rt-tests, rtl8812au-aircrack-ng, setserial, start-stop-daemon,
tinyssh, trace-cmd, vorbis-tools
2025.08-rc1, released August 11th, 2025
Fixes all over the tree and new features.
Arch: Add LoongArch64 architecture support
Toolchains:
- ARC toolchain updated to 2024.12
- Bootlin external toolchains updated to 2025.08-1
- GCC 15.1.0 added, 12.x dropped, 14.x is now default
- GCC 13.x updated to 13.4.0, 14.x updated to 14.3.0
- Default to Linux 6.16.x kernel headers
Misc:
- Various tweaks to utils/generate-cyclonedx for better SBOM
compatibility and project name/version customization
New defconfigs: BeagleY-AI, CoolPI 4B, Freescale i.MX91
Freedom, LoongArch64 EFI, QEMU LoongArch64 Virt, Raspberrypi
Compute Module 5 IO
New packages: containers-image-config, distribution-registry,
llvm-runtimes, lua-lrexlib-pcre2, msgpack-c, opencl-headers,
opencl-icd-loader, pocketpy, python-apscheduler, python-crc,
python-log-rate-limit, python-sdbus-modemmanager, soapy-sdr,
vulkan-sdk
Removed packages: libebur128, libolm, libwebsock,
python-dunamai, python-poetry-dynamic-versioning
2025.05.3, released October 11, 2025
This is the final release on the 2025.05.x branch.
Important / security related fixes:
- atop: CVE-2025-31160
- civetweb: CVE-2025-55763
- cjson: CVE-2025-57052
- connman: CVE-2025-32366, CVE-2025-32743
- cups: CVE-2025-58060, CVE-2025-58364
- exiv2: CVE-2023-44398, CVE-2024-24826, CVE-2024-25112, CVE-2024-39695,
CVE-2025-26623, CVE-2025-54080, CVE-2025-55304
- expat: CVE-2025-59375
- fastd: CVE-2025-24356
- fetchmail: CVE number pending
- ghostscript: CVE-2025-59798, CVE-2025-59799, CVE-2025-59800,
CVE-2025-59801
- imagemagick: CVE-2023-5341, CVE-2025-55004, CVE-2025-55005,
CVE-2025-55160
- intel-microcode: CVE-2025-20053, CVE-2025-20109, CVE-2025-22839,
CVE-2025-22840, CVE-2025-22889, CVE-2025-26403
- jasper: CVE-2023-51257, CVE-2025-8835
- libcurl: CVE-2025-10148, CVE-2025-9086
- libopenssl: CVE-2025-9230, CVE-2025-9231, CVE-2025-9232
- libssh: CVE-2025-8114, CVE-2025-8277
- lua: CVE-2014-5461
- opencv4: CVE-2025-53644
- pcre2: CVE-2025-58050
- poco: CVE-2025-6375
- postgresql: CVE-2025-8713, CVE-2025-8714, CVE-2025-8715
- python-django: CVE-2025-57833, CVE-2025-59681, CVE-2025-59682
- python-flask-cors: CVE-2024-6839, CVE-2024-6844, CVE-2024-6866
- python-pip: CVE-2025-8869
- raptor: CVE-2024-57822, CVE-2024-57823
- sqlite: CVE-2025-6965
- syslog-ng: CVE-2024-47619
- tiff: CVE-2024-13978, CVE-2025-8961, CVE-2025-9165
- udisks: CVE-2025-8067
- wireshark: CVE-2025-5601
Updated / fixed packages: asterisk, avrdude, boinc, boot-wrapper-aarch64,
cjson, cpp-httplib, cutekeyboard, docker-engine, ecryptfs-utils, fatcat,
fetchmail, firewalld, gnupg2, gnuplot, htpdate, iputils, jose, kodi,
libfreeimage, libopenssl, libselinux, libsemanage, libxkbcommon,
libxmlrpc, linux-firmware, linuxptp, llvm, lua-utf8, luaossl, luvi,
mariadb, mbpfan, micropython, modsecurity2, mosquitto, opencv4, openjpeg,
pango, php-lua, policycoreutils, python-aiohttp-session, python-certifi,
python-cryptography, python-flask-cors, python-pytz, python3, rtl_433,
ruby, samba4, sysprof, ti-k3-boot-firmware, tiff, tor, uclibc, upx,
webkitgtk, wlroots, x11r7, xilinx-embeddedsw, xilinx-prebuilt, zziplib
Removed package: netstat-nat
Boards updated / fixed: versal, ti_am62x_sk, qemu/{x86, x86_64},
zedboard, beagleboneai
Boards removed: roseapplepi, at91sam9260eknf, atmel_sama5d3xek
Test Improvements:
- TestSWIPL: increase timeout value
- TestOpenJdk: remove stime() function call
- test_hardening: update toolchain to aarch64 for checksec tests
- test_docker_compose: update kernel & VM CPU
- TestZfsUclibc: use internal backend for uClibc-ng toolchain
- GitTestBase: remove git daemon due to Gitlab-CI security settings
2025.05.2, released September 09, 2025
Important / security related fixes:
- libssh: CVE-2025-4878, CVE-2025-5318, CVE-2025-5351, CVE-2025-5372,
CVE-2025-5449, CVE-2025-5987
- glibc: CVE-2025-5702, CVE-2025-5745, CVE-2025-8058
- gnutls: CVE-2025-32989, CVE-2025-32988, CVE-2025-32990, CVE-2025-6395
- python3: CVE-2025-8194
- libhtp: CVE-2025-53537
- tiff: CVE-2025-8176, CVE-2025-8177
- libglib2: CVE-2025-6052
- ofono: CVE-2023-2794, CVE-2024-7537, CVE-2024-7539, CVE-2024-7540,
CVE-2024-7541, CVE-2024-7542
- elfutils: CVE-2025-1352, CVE-2025-1365, CVE-2025-1371, CVE-2025-1372,
CVE-2025-1376, CVE-2025-1377
- grub2: CVE-2024-45777, CVE-2024-45778, CVE-2024-45779,
CVE-2024-45780, CVE-2024-45782, CVE-2024-56737, CVE-2024-56738,
CVE-2025-0678, CVE-2025-0684, CVE-2025-0685, CVE-2025-0686,
CVE-2025-0689, CVE-2025-1125
- openjpeg: CVE-2025-54874
- go: CVE-2025-4674, CVE-2025-47907
- gst1-plugins-base: CVE-2025-47806, CVE-2025-47807
- gst1-plugins-good: CVE-2025-47219, CVE-2025-47183
- vorbis-tools: CVE-2023-43361
- vim: CVE-2024-41957, CVE-2024-41965, CVE-2024-45306, CVE-2024-47814,
CVE-2025-1215, CVE-2025-22134, CVE-2025-24014, CVE-2025-26603,
CVE-2025-29768, CVE-2025-53905, CVE-2025-53906
- ffmpeg: CVE-2023-6602
- lighttpd: CVE-2025-8671
- python-h2: CPE-2025-57804
- cpp-httplib: CVE-2025-46728
Removed packages: liboauth, thttpd
Removed defconfigs: at91sam9g20dfc, at91sam9g45m10ek,
at91sam9rlek, bananapro, beelink_gs1, chromebook_snow, galileo,
odroidxu4, orangepi_lite2, orangepi_one_plus, pcengines_apu2,
pine64_sopine, riotboard, rock64, rock_pi_n8, socrates_cyclone5,
toradex_apalis_imx6, ts7680, engicam_imx6*, kontron_pitx_imx8m,
imx6ulz_bsh_smm_m2,
Test Improvements:
- test_gstreamer1: raise tesseract-ocr timeout to 15s
- test_wine: fix test after bootlin toolchains update
- test_numactl: fix test after bootlin toolchains update
- test_dpdk: fix test after bootlin toolchains update
- test_msr_tools: fix test after bootlin toolchains update
- test_dmidecode: fix test after bootlin toolchains update
- test_iso9660: use a more recent toolchain
- test_grub: use glibc toolchain
- test_wget: replace thttpd by Busybox's httpd server
- test_libcurl: replace thttpd by Busybox's httpd server
- test_systemd_selinux: fix test after bootlin toolchains update
Updated / fixed packages: python-propcache, pipewire, apache, xinetd,
libssh, glibc, libhtp, libapparmor, libopenssl, rpi-firmware,
brcmfmac_sdio-firmware-rpi, grout, php-pecl-dbus, tini, snooze, ngrep,
libzenoh-pico, janet, cjson, flatcc, nanocom, rtl8189es, gcc, ofono,
python-numpy, elfutils, libtracefs, tinyssh, start-stop-daemon, bcusdk,
prboom, setserial, grub2, openjpeg, go, gstreamer1, gst1-plugins-base,
gst1-plugins-good, gst1-plugins-bad, gst1-plugins-ugly, gst1-devtools,
gst1-libav, gst1-python, gst1-rtsp-server, gst1-vaapi,
gstreamer1-editing-services, vorbis-tools, jq, lbijwt, vim, ffmpeg,
libv4l, python-yarl, lirc-tools, b43-firmware, tcpreplay, libsvgtiny,
libsoxr, lighttpd, uclibc, vde2, libcap-ng, python-h2, squid, ipmitool,
ell, proftpd, liblog4c-localtime, wpewebkit, weston, cpp-httplib,
ipset, python3, python-aexpect, libftdi1
Infrastructure updates/fixes:
- Various tweaks to utils/generate-cyclonedx for better SBOM
compatibility and project name/version customization
- go: make pre-built compiler provide target support too
- test-pkg: add new option -T/--toolchain-name
- pkg-utils.mk: include package directory in show-info output
- bump-stable-kernel-versions: new tool
Boards updated / fixed:
- qemu_sh4*: switch back to disk emulation
- acmesystems_acqua_a5_*: update linux
- sipeed_licheepi_zero: update linux & uboot
- zynqmp: increase vfat partition to 64M
- qemu_{arm,aarch64}_{ebbr,sbsa}*: linux needs host python3
- canaan_kd233, sipeed*: use BR2_LINUX_KENREL_IMAGE_TARGET_NAME
- ci20: U-Boot needs host-openssl
2025.05.1, released August 11th, 2025
Important / security related fixes:
- samba4: support Windows security hardening
- apache: CVE-2025-53020, CVE-2025-49812, CVE-2025-49630, CVE-2025-23048,
CVE-2024-47252, CVE-2024-43394, CVE-2024-43204, CVE-2024-42516,
CVE-2025-54090
- assimp: CVE-2025-2750, CVE-2025-2751, CVE-2025-2757, CVE-2025-3158
- clamav: CVE-2025-20260
- edk2: CVE-2024-38805
- git: CVE-2025-27613, CVE-2025-27614, CVE-2025-46835, CVE-2025-48384,
CVE-2025-48385, CVE-2025-48386
- jose: CVE-2023-50967
- libarchive: CVE-2025-5914, CVE-2025-5915, CVE-2025-5916, CVE-2025-5917,
CVE-2025-5918
- libavif: CVE-2025-48174, CVE-2025-48175
- libblockdev: CVE-2025-6019
- libbpf: CVE-2025-29481
- libglib2: CVE-2025-6052
- libheif: CVE-2025-43966, CVE-2025-43967
- libhtp: CVE-2024-45797
- libopenssl: CVE-2025-4575
- libsoup: CVE-2024-52530, CVE-2024-52531, CVE-2024-52532, CVE-2025-2784,
CVE-2025-4476, CVE-2025-4948, CVE-2025-4969, CVE-2025-32050,
CVE-2025-32052, CVE-2025-32053, CVE-2025-32906, CVE-2025-32910,
CVE-2025-32911, CVE-2025-32912, CVE-2025-32913, CVE-2025-32914,
CVE-2025-46420, CVE-2025-46421
- libxml2: CVE-2025-6021, CVE-2025-49794, CVE-2025-49796, CVE-2025-49795,
CVE-2025-6170
- mbedtls: CVE-2025-47917, CVE-2025-48965, CVE-2025-49087, CVE-2025-49600,
CVE-2025-49601, CVE-2025-52496, CVE-2025-52497
- micropython: CVE-2024-8947
- modsecurity2: 2025-47947, CVE-2025-48866
- orc: CVE-2024-40897
- php: CVE-2025-1735, CVE-2025-6491, CVE-2025-1220
- podman: CVE-2025-6032
- python-aiohttp: CVE-2025-53643
- python-django: CVE-2025-48432
- python-requests: CVE-2024-47081
- python-starlette: CVE-2025-54121
- python-urllib3: CVE-2025-50181, CVE-2025-50182
- python3: 2024-12718, CVE 2025-4138, CVE 2025-4330, CVE 2025-4435,
2025-4517
- redis: CVE-2025-32023, CVE-2025-48367
- rust-bindgen: CVE-2024-43806, RUSTSEC-2024-0006
- samba4: CVE-2025-0620
- shim: CVE-2024-2312
- sngrep: CVE-2024-3119, CVE-2024-3120
- sudo: CVE-2025-32462, CVE-2025-32463
- tcpreplay: CVE-2023-4256, CVE-2023-43279, CVE-2024-22654
- tinyxml: CVE-2023-34194
- wpewebkit: CVE-2024-27856, CVE-2024-40866, CVE-2024-44185,
CVE-2024-44187, CVE-2024-44192, CVE-2024-44244, CVE-2024-44296,
CVE-2024-44308, CVE-2024-44309, CVE-2024-54467, CVE-2024-54479,
CVE-2024-54502, CVE-2024-54505, CVE-2024-54508, CVE-2024-54534,
CVE-2024-54543, CVE-2024-54551, CVE-2024-54658, CVE-2025-24143,
CVE-2025-24150, CVE-2025-24158, CVE-2025-24162, CVE-2025-24201,
CVE-2025-24208, CVE-2025-24209, CVE-2025-24213, CVE-2025-24216,
CVE-2025-24223, CVE-2025-24264, CVE-2025-30427, CVE-2025-31204,
CVE-2025-31205, CVE-2025-31206, CVE-2025-31215, CVE-2025-31257
- xorg-server / xwayland: CVE-2025-49175, CVE-2025-49176, CVE-2025-49177,
CVE-2025-49178, CVE-2025-49179, CVE-2025-49180
Updated / fixed packages: amazon-ecr-credential-helper, at91bootstrap3,
avrdude, bcg729, berkeleydb, binutils, bmx7, boot/syslinux, ca-certificates,
chartjs, cifs-utils, cpp-httplib, cpulimit, daq, dht,
docker-credential-acr-env, docker-credential-gcr, elfutils, eudev, fwupd,
gcc, gnuplot, gstreamer1-editing-services, gumbo-parser, gvfs, hddtemp,
kvmtool, libargtable2, libcddb, libconfuse, libcrossguid, libcurl, libdex,
libesmtp, libgcrypt, libiec61850, libmanette, libmicrohttpd, libmpeg2,
libndp, libp11, libplatform, libspdm, libssh2, libuhttpd, libva, linux,
linux-tools (rtla), lpac, lrzsz, ltp-testsuite, lua, mjpg-streamer,
modem-manager, modsecurity2, mosquitto, mpv, mupdf, ncmpc, ncurses,
net-tools, network-manager, nginx-modsecurity, ntp, oniguruma, openblas,
parted, passt, php, python-asgiref, python-cython, python-dbus-fast,
python-dotenv, python-fastapi, python-future, python-glslang,
python-msgpack, python-multipart, python-remi, python-setuptools,
python-typing-extensions, qpid-proton, rapidjson, rauc-hawkbit-updater,
rtl8188eu, rtl8723bu, rtl8723ds, rtl8821au, rust, sdl2, shadowsocks-libev,
shairport-sync, sox, sqlite, squashfs, sudo, systemd, systemd, tailscale,
tor, uclibc, ustream-ssl, watchdog, webkitgtk, wpebackend-fdo, xen
Removed package: libebur128, libolm, libwebsock
Infrastructure updates / fixes:
- python-glslang is now a host package only
- Makefile unexports are now fixed and sorted
- hide gcc version for unsupported CPUs
- check-package: handle missing files
- test-pkg: stop on sigint
- toolchain/toolchain-wrapper.c:
- correct CCACHE_BASEDIR comment
- slightly simplify cmdline copying
- get rid of EXCLUSIVE_ARGS
- erofs: reword "all-fragments" Kconfig text
- utils/update-rust: fix MIT hash
Test improvements:
- add new test for nginx-modsecurity
- new runtime test for gumbo-parser
- add a crun-based runtime test for docker-compose
- test_xen: add a base class
- test_xen: test on 32-bit Arm v7
- test_xen: rename TestXen to TestXenAarch64
Boards updated / fixed:
- globalscale_espressobin: update linux
- freescale/mxs: fix Linux booting
- ti_am62x_sk: bump Linux version
- beaglebone: bump Linux to 6.12.23-ti-arm32-r11
2025.05, released June 9th, 2025
Various fixes.
Updated/fixed packages: armadillo, busybox, dhcpcd, dovecot,
easyframes, exim, ghostscript, go, gst1-plugins-bad, iputils,
jq, libcurl, libftdi1, libglib2, lm-sensors,
mender-update-modules, mesa3d, mongoose, mpd, ninja, podman,
python-django, python-gobject, qoriq-mc-utils, qt5declarative,
qt5webengine, qt5webengine-chromium, qt6base, qt6tools, redis,
rtl8723ds, spirv-llvm-translator, unzip, yasm
2025.05-rc2, released May 28th, 2025
Fixes all over the tree.
Defconfigs: imx8mn-bsh-smm-s2: Unbreak boot after move to
U-Boot 2025.04.
Updated/fixed packages: assimp, atkmm, atkmm2_28, binutils,
casync-nano, esp-hosted, gmrender-resurrect, gtkmm3, kmsxx,
libcamera, libglade, linux, lzo, python-click, python-django,
python-flask-restx, python-pydantic, python-pydantic-core,
python-referencing, python-tornado, sane-airscan, systemd,
uacme, uuu
2025.05-rc1, released May 19th, 2025
Fixes all over the tree and package updates.
Download:
- Rust updated to version 1.86.0, which has slightly changed
the cargo fetching behaviour, so the generated tarballs now
use a -cargo4 suffix to reflect that.
- Subversion download logic is now reproducible with non-US
locales
- Sources can now be fetched from a smb:// location (using
curl).
Dependencies:
- AWK is now required on the build host.
Toolchains:
- Bootlin ARMv7-A toolchains are now also available for
ARMv8-A CPUs in 32bit mode
Misc:
- /etc/resolv.conf symlink now points to /run rather than /tmp
- support/scripts/pkg-stats can now report stale CVE entries,
E.G. entries in <PKG>_IGNORE_CVES that are no longer needed
after a NVD update.
New defconfigs: Engicam PX30 SOM, Freescale i.IM 91 EVK and 93
Freedom, HiFive Unmatched, Pine64 ROCKPro64 EBBR boot,
Raspberrypi 2 in 64bit mode, Sipeed LicheePi 4A
New packages: aardvark-dns, amazon-ecr-credential-helper,
casync-nano, cgroupfs-v2-mount, docker-credential-acr-env,
docker-credential-gcr, grout, lowdown, lpac,
mender-update-modules, netavark, passt, podman,
python-aniso8601, python-cachelib, python-emailproxy,
python-flask-caching, python-flask-restx, python-mypy,
python-pyproj, python-simple-pid, python-smbus2,
python-types-psutil, python-types-setuptools,
python-typing-inspection, python-tzlocal,
qoriq-ddr-phy-binary, qoriq-firmware-inphi, qoriq-mc-binary,
qoriq-mc-utils, sane-airscan, sipeed-lpi4abin, ufs-utils,
xilinx-fpgautil
Issues resolved:
- openh264's build/ should not be removed
https://gitlab.com/buildroot.org/buildroot/-/issues/64
- package/dbus: incorrect session bus configuration file..
https://gitlab.com/buildroot.org/buildroot/-/issues/67
- Update pkcs11-tool to v1.9.1
https://gitlab.com/buildroot.org/buildroot/-/issues/109
- netsnmp: unexpected header length in /proc/net/snmp...
https://gitlab.com/buildroot.org/buildroot/-/issues/110
2025.02.11, released February 20, 2026
avahi: CVE-2021-3468, CVE-2023-38469, CVE-2023-38470, CVE-2023-38471,
CVE-2023-38472, CVE-2023-38473, CVE-2024-52615, CVE-2024-52616,
CVE-2025-68276, CVE-2025-68468, CVE-2025-68471, CVE-2026-24401
bind: CVE-2025-13878
busybox: CVE-2025-46394, CVE-2025-60876
expat: CVE-2026-24515, CVE-2026-25210
glibc: CVE-2025-15281, CVE-2026-0861, CVE-2026-0915
gnutls: CVE-2025-14831, CVE-2026-1584
haproxy: CVE-2025-11230
intel-microcode: CVE-2024-24853, CVE-2025-31648
libopenssl: CVE-2025-11187, CVE-2025-15467, CVE-2025-15468,
CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419,
CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796
libpng: CVE-2026-22695, CVE-2026-22801, CVE-2026-25646
libtasn1: CVE-2025-13151
libvpx
linux-pam: CVE-2024-10963
nginx: CVE-2025-53859
nodejs: CVE-2025-27210, CVE-2025-55130, CVE-2025-55131, CVE-2025-55132,
CVE-2025-59465, CVE-2025-59466, CVE-2026-21637
python-django: CVE-2025-13473, CVE-2025-14550, CVE-2026-1207, CVE-2026-1285,
CVE-2026-1287, CVE-2026-1312
python-urllib3: CVE-2026-21441
strongswan: CVE-2025-62291
tor: TROVE-2025-016
vim: CVE-2025-66476
webkitgtk
Infrastructure updates/fixes:
arm-trusted-firmware, at91bootstrap3, barebox, linux, opensbi, optee-os,
uboot: Add support for custom license files
config-fragments/autobuild: drop a number of duplicated toolchains
generate-cyclonedx: fix dependencies
Makefile: add check-package-external target
pkg-stats: add -N/--needs-update option
pkg-stats: fix RuntimeError with python 3.14 asyncio
relocate-sdk.sh: pre-calculate files in need of relocation
system/Config.in: do not reference md5 for sha256 option
testing/run-tests: specify multiprocessing method
testing: python-requests: new runtime test
testing: test_python.py: disable interpreter colors
testing/tests/package/test_firewalld: use ext2 instead of cpio
Updated / fixed packages: asterisk, at91bootstrap3, avahi, berkeleydb,
bind, bitcoin, brltty, busybox, cryptsetup, dash, dc3dd, docker-engine,
easy-rsa, ell, expat, frr, glibc, gnutls, haproxy,
igmpproxy, intel-microcode, libcec, libcurl, libgphoto2, libgpiod2,
libite, libopenssl, libpng, libselinux,
libtasn1, libucl, libvpx, libwebsockets, linux, linux-headers,
linux-pam, localedef, lockdev, m4, manual, mcelog, mesa3d, mp4v2,
mpg123, mpir, mupdf, netdata, nginx, nodejs, php, php-lua, pkg-utils,
python3, python-django, python-jinja2, python-urllib3, rp-pppoe,
rust-bindgen, safeclib, screen, shadow, spandsp, strongswan, swig,
syslog-ng, tor, uclibc, uftp, util-linux, vim, webkitgtk,
wireless-regdb, xmlstarlet, zeek
New package: libpam-pkcs11
Removed packages: criu, cvs, dbus-triggerd, dvdrw-tools, libsvg, libsvg-cairo, lockdev, gconf,
2025.02.10, released January 20, 2026
Important / security related fixes: